An employee's personal phone got hacked and has company data on it — what should we do immediately?

Have the employee put the phone into airplane mode immediately and pull the SIM card out. Suspicious SMS malware might be reading texts in the background to steal incoming 2FA codes. Any password resets you do from a PC could be compromised if you don't cut off incoming SMS traffic first.

Check the OAuth permissions on your email server. The malware might have grabbed a persistent API token through the mail client on the device. Even if you change passwords, if an unfamiliar third-party app is authorized, access will persist.

Under DSGVO, the 72-hour notification clock starts the moment the breach is discovered. Check whether the technical specs contain personal data, and review the data protection agreement with the public agency running the tender. If the risk is high, you'll need to submit a preliminary notification to the state data protection commissioner (Landesdatenschutzbeauftragter).

Last year one of our architects had their account compromised in a similar phishing scam. We killed all sessions within the first 2 hours, and the audit logs showed they only pulled 3 emails from the inbox. We spent 1.400 EUR on an external forensic investigation, but the data authority didn't issue any fines.

First 3 hours checklist: 1) Isolate the device from the network (airplane mode and pull the SIM), 2) Revoke all sessions from the admin console and reset password/MFA, 3) Export cloud download logs for the last 24 hours, 4) Warn the rest of the company about the SMS scam.

Did the employee have a separate work profile (sandbox) configured for company email or was it set up via IMAP directly in the stock mail app? Is it Android or iOS? Those details are critical to figuring out whether data actually leaked.

do we need to changge the shared office Wi-Fi password too? the employee was connected to the office network yesterday with that phone could the other computers there be infected?

if u don't have a byod policy do not remotely wipe the whole phone then last year a friend of mine did a full wipe on a staff member's phone, employee went to labor coourt claiming their kid's wedding photos were gone and won the case.

Don't miss this: Most time waste accumulates in tasks waiting for approval.

Just leaving this note, it might be useful.

I didn't know that.

I have a question, don't want to go off-topic though. The biggest time-waster for us was not knowing who had the final say.

That's all, sorry if I went on too long.

I'm in the same situation that's why I'm asking. Everything goes well for the first three months; problems arise in the fourth.

I'm also curious if anyone does it differently.

I felt relieved reading this answer, so it's not just me. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

I'm curious too. Processes without records never improve, because you don't know what to fix.

Correct me if I'm wrong.

I agree with this. Start with a small trial; don't commit to everything at once.

Correct me if I'm wrong.

I completely agree. When we decide without measuring, we always end up in the same place.

Don't hesitate to ask; those who don't ask always pay more. Good luck with that.

Let me summarize the topic, since several different answers were given. anyway taking notes for two weeks yields better results than a six-month estimate.

Correct me if I'm wrong.

I'm in the same situation, that's why I'm asking. Start with a small trial; don't commit to everything at once.

Good luck with that.